Can’t Get Kerberos Going

Server is bound to AD. DNS is running on AD server. DNS name and IP resolve correctly. OD is only service running on this server and server is setup as an OD master. My OD groups are composed solely of AD users. Kerberos won't start. Click the Kerberize button. Enter diradmin and password. Click OK - nothing happens. Would demoting the server to standalone then back to OD master help with Kerberos? Will this hose the existing OD users? As long as clients are bound to AD and OD, they are managed (MCX). If they are only bound to OD then they are not managed. I think kerberos is the issue. What logs can I look in to find the problem? I've seen this issue on the boards here but no solutions. update: when use sso_util to configure kerboros I get the following: Contacting the directory server Configuring for Active Directory Unable to cofigure service http error = 2 Unable to cofigure service HTTP error = 2 Cleaning up